Perimeter
6/30/2011
04:52 PM
Commentary
Commentary
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Mass-Meshing A Gumblar Creation

Who doesn't love a new buzzword? 'Mass-meshing' is a new term that describes an old problem first presented by the Gumblar attacks in 2009

Recent media reports point to a supposed new type of attack that has been dubbed "mass-meshing" by the folks over at Amortize.

The Amortize report states, “We want to report a new type of mass-scale drive-by download attack that we'll dub "Mass Meshing Injection."" The report then goes on to explain what it is and how it differs from a SQL injection attack. The crux of their concern is that in this “new type” of attack, “Every redirector is itself an infected domain, which means blacklisting becomes more difficult and prune to false alerts.”

But that was exactly the case two years ago with Gumblar. From our ScanSafe blog post then:

“In a typical outbreak situation, there are compromised websites that act as a conduit for malware hosted on an attacker owned site. But in this case, the malware resides on thousands of legitimate (but compromised) websites.”

Of course, all those Gumblar-backdoored websites proved fertile grounds for other attackers to abuse, and in October 2009 we saw Zeus adapting this same method:

“Interestingly, compromised pages are also being injected with external source references to the malware contained on other compromised sites. Those who followed last week's report of the newest Gumblar technique will recall that unlike traditional compromises which simply inject pointers to malware hosted on an attacker-owned domain, in these attacks the compromised domain is also acting as host for the malware itself."

At the time, we also noted that:

"This method of attack complicates remediation via technologies that rely on blacklisting because the number of compromised websites (now acting as malware hosts) is in the thousands.”

And we also reported the same method being used in a random malvertising attack in 2010:

“ScanSafe STAT has been investigating an ongoing series of attacks which has been a hotbed for zero day exploits over the first quarter of 2010. The attackers are using three layers of legitimate sites. Two layers are compromised websites used to host malicious content that is then subsequently pushed to a third layer of legitimate websites via syndicated ads.”

The above references aren't to minimize the severity of mass-meshing style attacks, but rather just to point out that the mass-meshing technique isn't new.

Indeed, today it is pretty common to see interwoven attacks in which the compromised sites work in concert to interchangeably serve as conduit, redirector, and/or the actual malware host.

And while it does pose some additional challenges, overall security vendors seem to be coping fairly well with it. (Though obviously anyone relying purely on blacklisting would have a problem, but most use more layered defenses).

I have to say though that while the attack method isn't new, mass-meshing is a pretty cool, new buzzword to describe it.

Mary Landesman is an antivirus professional and senior security researcher for ScanSafe, now part of Cisco. In 2009 she was awarded a Microsoft MVP for her work in consumer security.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4725
Published: 2014-07-27
The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/.

CVE-2014-4726
Published: 2014-07-27
Unspecified vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before 2.6.8 for WordPress has unspecified impact and attack vectors.

CVE-2014-2363
Published: 2014-07-26
Morpho Itemiser 3 8.17 has hardcoded administrative credentials, which makes it easier for remote attackers to obtain access via a login request.

CVE-2014-2625
Published: 2014-07-26
Directory traversal vulnerability in the storedNtxFile function in HP Network Virtualization 8.6 (aka Shunra Network Virtualization) allows remote attackers to read arbitrary files via crafted input, aka ZDI-CAN-2023.

CVE-2014-2626
Published: 2014-07-26
Directory traversal vulnerability in the toServerObject function in HP Network Virtualization 8.6 (aka Shunra Network Virtualization) allows remote attackers to create files, and consequently execute arbitrary code, via crafted input, aka ZDI-CAN-2024.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.